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We  are  providing  this  report  for  information  and  use.  This  report  is  one  in  a 
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Report  No.  D-2000-031  November  4, 1999 

(Project  No.  9LF-'5046) 

Year  2000  End-to-End  Tests  for  the 
Military  Health  System 

Executive  Summary 


Introduction.  This  report  is  one  of  a  series  being  issued  by  the  Inspector  General, 
DoD,  in  accordance  with  an  informal  partnership  with  the  Chief  Information  Officer, 
DoD,  to  monitor  DoD  efforts  to  address  the  year  2000  computing  challenge.  For  a 
complete  listing  of  audit  projects  addressing  the  year  2000  issue,  see  the  year  2000  web 
pages  on  the  IGnet  at  http://www.ignet.gov. 

End-to-end  testing  in  the  Military  Health  System  involves  three  functional  areas: 
patient  care,  patient  administration,  and  medical  logistics.  In  addition  to  DoD 
automated  information  systems,  the  systems  of  managed  care  support  contractors  and 
medical  materiel  prime  vendors  participate  in  the  patient  administration  and  medical 
logistics  functional  areas,  respectively. 

Objectives.  The  overall  audit  objective  was  to  evaluate  the  effectiveness  of  year  2000 
end-to-end  tests  planned  for  DoD  health  care  systems.  Specifically,  we  reviewed  test 
plans  and  results  associated  with  DoD  health  care  systems  and  systems  owned  by 
managed  care  support  contractors  and  medical  materiel  prime  vendors. 

Results.  The  Assistant  Secretary  of  Defense  (Health  Affairs)  made  significant  progress 
in  the  planning  and  execution  of  Military  Health  System  end-to-end  tests.  Test  plans 
for  the  patient  care,  patient  administration,  and  medical  logistics  health  functions  were 
developed  in  accordance  with  the  DoD  Year  2000  Management  Plan.  Seven  of  the  nine 
core  health  care  business  processes  were  identified  as  critical.  Multisystem  testing  of 
health  care  systems  supporting  the  seven  processes  was  planned  for  11  of  the  12 
mission-critical  systems.  The  12th  system  was  excluded  from  end-to-end  testing 
because  it  does  not  interface  with  other  mission-critical  systems.  Patient  care,  patient 
administration,  and  medical  logistics  tests  were  completed  by  September  22,  1999. 

Test  results  were  generally  positive,  and  software  modifications  were  developed  for  one 
problem  identified  in  each  of  the  patient  administration  and  medical  logistics  tests. 
However,  subsequent  to  medical  logistics  testing  and  before  the  year  2000,  three 
medical  materiel  prime  vendor  contracts  are  scheduled  to  be  awarded.  The  timing  of 
the  new  contracts  may  result  in  new  vendors  that  would  not  have  had  the  opportunity  to 
participate  in  the  medical  logistics  end-to-end  tests.  See  the  Finding  section  for  details. 

Summary  of  Recommendations.  We  reconunend  that  the  Assistant  Secretary  of 
Defense  (Health  Affairs)  obtain  the  year  2000  due  diligence  statements  from  contractors 


associated  with  the  patient  administration  end-to-end  testing.  We  also  recommend  that 
the  Assistant  Secretary  of  Defense  (Health  Affairs)  monitor  any  transitions  to  medical 
materiel  prime  vendors  that  have  not  participated  in  end-to-end  tests. 

Management  Comments.  The  Military  Health  System  Chief  Information  Officer 
concurred  with  the  finding  and  recommendations.  The  Chief  Information  Officer  stated 
that  the  one  outstanding  due  diligence  statement  from  a  managed  care  support 
contractor  was  received  on  September  17,  1999,  and  that  due  diligence  statements  are 
now  on  file  for  all  contractors  who  participated  in  the  patient  administration  area  end- 
to-end  testing.  Also,  the  Chief  Information  Officer  stated  that  the  Office  of  the 
Assistant  Secretary  of  Defense  (Health  Affairs)  is  continuing  to  work  closely  with  the 
contracting  personnel  executing  the  prime  vendor  contracts  scheduled  to  be  awarded 
between  October  and  November  1999.  All  new  contracts  contain  the  reference  that 
vendors  must  have  year  2000  capable  systems.  However,  if  a  contract  is  awarded  to  a 
new  prime  vendor,  end-to-end  testing  will  be  completed  before  the  operational  use  of 
electronic  transactions  with  that  vendor.  See  the  Finding  section  for  a  discussion  of 
management  comments  and  the  Management  Comments  section  for  the  complete  text  of 
the  comments. 
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Background 


Public  Law.  Public  Law  105-261,  “National  Defense  Authorization  Act  for 
Fiscal  Year  1999,”  October  17,  1998,  Section  334(b),  directs  that  the  Secretary 
of  Defense  ensure  that  “all  mission  critical  systems  that  are  expected  to  be  used 
if  the  Armed  Forces  are  involved  in  a  conflict  in  a  major  theater  of  war  are 
tested  in  at  least  two  exercises.”  In  addition.  Section  334(d)  states: 

“Alternative  Testing  Method.  In  the  case  of  an  information  technology  or 
national  security  system  for  which  a  simulated  year  2000  test  as  part  of  a 
military  exercise  described  in  subsection  (c)  is  not  feasible  or  presents  undue 
risk,  the  Secretary  of  Defense  shall  test  the  system  using  a  functional  end-to-end 
test  or  through  a  Defense  Major  Range  and  Test  Facility  Base.” 

End-to-End  Testing.  The  DoD  Chief  Information  Officer  has  the  overall 
responsibility  for  overseeing  the  DoD  solution  to  the  year  2000  (Y2K)  problem. 
Guidance  is  provided  in  the  “DoD  Year  2000  Management  Plan,  Version  2.0” 
(the  DoD  Management  Plan),  December  1998.  The  DoD  Management  Plan 
requires  that  all  mission-critical  systems,  except  those  involved  in  a  major 
theater  war,  be  tested  in  a  functional  area  end-to-end  test  or  a  Service-sponsored 
Y2K  system  integration  test. 

The  DoD  Management  Plan  defines  end-to-end  testing  as  an  assessment  of  a 
fonctional  area  to  determine  the  Y2K  operational  readiness  of  its  primary 
functions.  The  assessment  process  includes  an  identification  of  the  core 
processes  and  the  associated  systems,  an  assessment  of  the  readiness  of  those 
systems,  and  a  determination  of  coverage  in  Joint  Staff/commander  in  chief 
operational  evaluations.  That  information  will  be  used  to  determine  the  need  for 
additional  testing  to  fully  demonstrate  the  operational  readiness  of  the  primary 
functions.  The  DoD  Management  Plan  states  that  the  purpose  of  end-to-end 
tests  is  to  give  assurance  beyond  that  provided  by  development,  acceptance,  and 
system  certification  testing. 

Results  of  each  end-to-end  test  are  to  be  documented  in  two  reports.  A  quick 
look  report  will  be  produced  within  7  days  of  test  completion.  Within  30  days 
of  completion,  a  final  report  is  required  that  includes  Y2K  test  pass  or  fail 
judgments,  lessons  learned,  and  specific  recommendations. 

End-to-End  Testing  Responsibilities  for  the  Military  Health  System.  The 
Assistant  Secretary  of  Defense  (Health  Affairs)  (ASD[HA])  is  responsible  for 
issuing  policy  and  providing  oversight  of  the  military  health  functional  area. 

The  TRICARE  Management  Activity  (TMA)  Y2K  Project  Office  (Y2K  Project 
Office)  has  overall  responsibility  for  Y2K  compliance  of  Military  Health  System 
(MHS)  automated  information  systems  (AISs)  and  for  oversight  of  the  planning, 
execution,  and  evaluation  of  the  military  health  functional  area  end-to-end 
testing.  The  testing  includes  three  major  health  functions  necessary  for  mission 
fulfillment:  patient  care,  patient  administration,  and  medical  logistics.  Seven  of 
the  nine  core  business  processes  associated  with  the  three  functions  were 
identified  as  mission-critical  and  included  in  the  end-to-end  testing.  Of  the  12 
mission-critical  AISs  that  support  the  MHS,  only  one  medical  logistics  system 
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was  excluded  from  end-to-end  testing.  The  one  system  was  excluded  because  it 
does  not  interface  with  a  mission-critical  process.  The  testing  of  each  major 
health  function  will  be  controlled  by  a  functional  readiness  assessment  event 
plan  (test  plan). 

Patient  Care.  The  core  business  processes  in  the  patient  care  area  are 
patient  diagnosis,  treatment,  and  immunization.  The  processes  are  dependent 
upon  the  sharing  of  clinical  and  demographic  data  using  interfaces  between  and 
among  systems.  Because  the  Composite  Health  Care  System  (CHCS)  supports 
most  patient  care  functions  within  a  military  treatment  facility,  many  of  the 
mission-critical  processes  involve  the  interface  between  CHCS  and  another 
clinical  AIS  or  laboratory  instrument.  For  example,  ordering  and  supplying 
blood  for  transfusions  is  a  mission-critical  patient  care  process.  CHCS 
interfaces  with  tihe  Defense  Blood  Standard  System  to  expedite  the  process  of 
ordering  and  supplying  blood  for  patient  transfusions.  In  addition  to  MHS 
systems,  the  patient  care  tests  include  three  non-MHS  personnel  and  readiness 
AISs:  two  versions  of  the  Defense  Enrollment  Eligibility  Reporting  System 
(DEERS)  and  the  Persian  Gulf  Evaluation  Program.  DEERS  contains 
enrollment  eligibility  information  used  to  verify  entitlement  to  a  variety  of 
services,  including  health  care.  The  Persian  Gulf  Evaluation  Program  provides 
data  concerning  the  Persian  Gulf  War  syndrome. 

Patient  Administration.  The  core  business  processes  in  the  patient 
administration  area  are  eligibility,  enrollment,  and  claims  processing.  The 
processes  involve  the  following  DoD  AISs:  CHCS,  the  Central  Deductible  and 
Catastrophic  Cap  File,  and  DEERS.  CHCS  and  the  Central  Deductible  and 
Catastrophic  Cap  File  are  medical  AISs.  CHCS  supports  patient  care  and 
administration  fonctions  that  include  appointment  scheduling;  inpatient  activity 
records;  outpatient  administration;  test  ordering;  test  results  reporting;  and 
laboratory,  pharmacy,  and  radiology  reporting  requirements.  The  Central 
Deductible  and  Catastrophic  Cap  File  maintains  data  about  individual  and  family 
deductible  and  catastrophic  limits.  DEERS  contains  information  used  to  verify 
entitlement  to  health  care.  The  end-to-end  tests  also  included  AISs  used  by  the 
managed  care  support  contractors.  Those  AISs  assist  in  providing  supplemental 
health  care  services  to  authorized  beneficiaries  through  the  private  sector  health 
care  infrastructure  and  in  processing  patient  claims. 

Medical  Logistics.  Medical  logistics  has  three  core  business  processes: 
acquisition  (using  prime  vendors),  materiel  management,  and  financial  payment. 
Only  the  acquisition  of  pharmaceutical  and  medical  surgical  supplies  was 
identified  as  a  mission-critical  process  and  included  in  end-to-end  testing.  The 
acquisition  process  entails  the  ordering  of  pharmaceutical  and  medical  surgical 
supplies,  and  prime  vendor  acknowledgement  of  the  order.  Each  prime  vendor 
is  required  to  have  a  fully  operational  on-line  electronic  order  entry  system  that 
the  military  treatment  facilities  can  access.  The  Army  and  Air  Force  have 
mission-critical  systems  that  interface  with  the  electronic  order  entry  system 
through  the  Defense  Medical  Lxigistics  Standard  Support  system.  The  Navy  has 
an  acquisition  system  but  was  not  included  in  the  testing  because  data  is 
manually  entered  into  the  prime  vendor  electronic  order  entry  system. 
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Objectives 


The  overall  audit  objective  was  to  evaluate  the  effectiveness  of  Y2K  end-to-end 
tests  planned  for  DoD  health  care  systems.  Specifically,  we  reviewed  test  plans 
and  results  associated  with  DoD  health  care  systems  and  systems  owned  by 
managed  care  support  contractors  and  medical  materiel  prime  vendors.  See 
Appendix  A  for  a  discussion  of  the  audit  scope  and  methodology  and  for  a 
summary  of  prior  coverage. 
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End-to-End  Tests  for  the  Military 
Health  System 

ASD(HA)  made  significant  progress  in  the  planning  and  execution  of 
MHS  end-to-end  tests.  Test  plans  for  the  patient  care,  patient 
administration,  and  medical  logistics  health  functions  were  developed  in 
accordance  with  the  DoD  Management  Plan.  Seven  of  the  nine  core 
health  care  business  processes  were  identified  as  critical.  The  testing  of 
health  care  systems  supporting  the  seven  processes  was  planned  for  11  of 
the  12  mission-critical  systems.  The  12th  system  was  excluded  from 
end-to-end  testing  because  it  does  not  interface  with  other  systems. 
Patient  care,  patient  administration,  and  medical  logistics  tests  were 
completed  by  September  22,  1999.  Test  results  were  generally  positive, 
and  software  modifications  were  developed  for  one  problem  identified  in 
each  of  the  patient  administration  and  medical  logistics  tests.  However, 
subsequent  to  testing  and  before  the  year  2000,  three  medical  materiel 
prime  vendor  contraets  are  scheduled  to  be  awarded.  The  timing  of  the 
new  contracts  may  result  in  new  vendors  that  would  not  have  had  the 
opportunity  to  participate  in  the  medical  logistics  end-to-end  tests.  The 
ASD(HA)  needs  to  closely  monitor  the  possible  transition  to  new 
vendors  late  in  1999  to  minimize  the  risks  associated  with  the 
year  2000  rollover. 


MHS  Test  Plans 


End-to-end  testing  within  the  MHS  consists  of  an  assessment  to  determine  the 
Y2K  operational  readiness  of  primary  functions.  The  testing  is  controlled  by  the 
“Military  Health  System  Year  2000  Functional  Readiness  Assessment  Master 
Test  Plan,  ”  dated  October  1998  and  updated  in  April  1999.  The  plan  states  that 
the  MHS  is  supported  by  a  compilation  of  individual  systems  for  which  there  is 
no  hierarchical  structure.  Clusters  of  two  and  three  systems  with  mission- 
critical  processes  must  be  tested  and  validated.  Those  processes  will  not  be 
tested  in  an  operational  environment,  because  the  facilities  and  systems  are 
critical  to  patient  safety  and  are  in  use  24  hours  a  day.  Therefore,  the  plan  calls 
for  a  test  facility,  the  Advanced  Technology  Integration  Center  established 
within  the  TMA,  to  be  used  to  simulate  the  operational  environment  to  ensure 
critical  health  care  functions  would  not  be  interrupted.  The  plan  identifies  three 
major  health  functions  necessary  for  mission  fulfillment  of  the  health  functional 
area:  patient  care,  patient  administration,  and  medical  logistics. 


Status  of  End-to-End  Testing 


Test  plans  for  patient  care,  patient  administration,  and  medical  logistics  areas 
were  developed  in  accordance  with  the  DoD  Management  Plan.  Seven  of  the 
nine  core  health  care  business  processes  were  identified  as  critical.  The  testing 
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of  health  care  systems  supporting  the  seven  processes  was  planned  for  1 1  of 
the  12  mission-critical  systems.  The  12th  system  was  excluded  from  end-to-end 
testing  because  it  does  not  interface  with  a  mission-critical  process.  All  tests 
planned  for  the  three  areas  were  completed  as  of  September  22,  1999.  Test 
results  were  generally  positive,  and  software  modifications  were  developed  for 
one  problem  identified  in  each  of  the  patient  administration  and  medical  logistics 
tests. 

Adequacy  of  Test  Plans.  Test  plans  for  each  of  the  three  functional  areas  were 
developed  in  accordance  with  the  DoD  Management  Plan.  Each  AIS  had 
undergone  system-level  testing  and  had  been  certified  as  Y2K  compliant  before 
being  included  in  the  tests.  A  coordinator  for  each  functional  area  was  assigned 
responsibility  for  all  aspects  of  test  planning,  execution,  and  evaluation. 
Assisting  each  coordinator  was  a  team  comprising  representatives  of  appropriate 
organizations.  The  teams  included,  as  appropriate,  representatives  from  the 
Y2K  Project  Office  and  the  Advanced  Technology  Integration  Center  within 
TMA,  the  Developmental  Testing  and  Evaluation  Office  and  other  offices  within 
system  program  offices,  the  Defense  Manpower  Data  Center,  contractors,  and 
lead  agents. 

Specific  processes  within  each  core  business  process  were  identified  and 
evaluated  for  inclusion  in  end-to-end  tests.  The  determination  to  test  a  process 
was  made  based  on  the  process  meeting  one  of  the  following  criteria: 

•  a  mission-critical  system  interfacing  with  another  mission-critical 
system, 

•  a  mission-critical  system  interfacing  with  a  nonmission-critical 
system  that  supports  a  mission-critical  function  or  capability,  or 

•  a  mission-critical  system  interfacing  with  a  nonmission-critical 
system,  with  an  interface  passing  date-sensitive  data  that  requires  one 
or  both  systems  to  calculate  or  recalculate  date  fields. 

Test  scenarios  were  designed  to  test  data  transactions  on  dates  surrounding  the 
year  2000  fiscal  year,  calendar  year,  and  leap  day.  The  Y2K  Project  Office 
conducted  Pre-Test  Readiness  Reviews  prior  to  the  tests,  at  which  time  the  test 
scenarios  were  approved. 

Patient  Care  Plan.  The  test  plan  for  the  patient  care  area  was  prepared 
in  accordance  with  the  DoD  Management  Plan.  The  test  plan  was  approved  in 
May  1999.  The  plan  required  that  a  coordinator  be  assigned  responsibility  for 
all  aspects  of  test  planning,  execution,  and  evaluation.  Also,  each  AIS  included 
in  the  plan  had  undergone  system-level  testing  and  had  been  certified  as 
Y2K  compliant. 

Patient  Administration  Plan.  The  test  plan  for  the  patient 
administration  area  was  prepared  in  accordance  with  the  DoD  Management 
Plan.  The  test  plan  for  the  patient  administration  area  included  the  participation 
of  the  managed  care  support  contractors.  Personnel  from  the  Y2K  Project 


5 


Office  validated  test  scenarios  developed  by  the  contractors  to  ensure  that  all 
processes  and  data  flows  were  tested  adequately  and  accurately  represented  a 
normal  operational  environment.  In  addition,  the  Y2K  Project  Office  evaluated 
the  contractors’  Y2K  programs  and  determined  that  there  were  no  significant 
Y2K  problems.  The  Y2K  Project  Office  also  requested  that  each  of  the 
contractors  provide  assurances  that  their  AISs  were  Y2K  compliant.  The 
contractors  agreed  to  provide  signed  documentation  that  they  exercised  due 
diligence  in  Aeir  Y2K  compliance  efforts  by  June  30,  1999.  However,  as  of 
September  9,  1999,  the  Y2K  Project  Office  had  received  assurances  from  only 
five  of  the  six  contractors.  The  Y2K  Project  Office  was  in  the  process  of 
following  up  on  the  status  of  the  remaining  responses. 

Medical  Logistics  Plan.  The  test  plan  for  the  medical  logistics  area  was 
prepared  in  accordance  with  the  DoD  Management  Plan.  The  draft  medical 
logistics  test  plan  excluded  one  Army  and  one  Air  Force  mission-critical 
medical  logistics  systems.  However,  TMA  had  noted  the  exclusion  and  directed 
a  modification  to  the  draft  test  plan  to  include  the  Service-level  mission-critical 
systems  in  the  next  draft  of  the  test  plan.  The  medical  logistics  test  plan 
included  the  participation  of  prime  vendors.  The  prime  vendors  provided  due 
diligence  statements  that  all  12  prime  vendor  systems  expected  to  be  in  use  in 
December  1999  were  Y2K  compliant.  Because  those  systems  do  not  belong  to 
DoD,  the  documentation  is  important  to  the  MHS  to  ensure  the  mission-critical 
business  process  is  not  impacted  by  Y2K-related  problems.  It  is  important  to 
note  that  if  the  electronic  order  entry  system  does  not  work,  there  is  ^  easy 
alternative  for  ordering  medical  materiel.  The  military  treatment  facilities  can 
place  orders  by  telephone  or  by  fax,  and  the  prime  vendor  will  acknowledge 
receipt  of  the  order  by  similar  means. 

Test  Results.  Patient  care,  patient  administration,  and  medical  logistics  tests 
were  completed  by  September  22,  1999.  Test  results  were  generally  positive, 
and  software  modifications  were  developed  for  one  problem  identified  by  the 
patient  administration  tests  and  one  problem  identified  by  the  medical 
logistics  tests. 

Patient  Care  Results.  The  patient  care  tests  demonstrated  success  in 
sending  and  receiving  date-related  data  in  a  Y2K  environment.  The  quick  look 
report  summarizing  results  of  the  patient  care  tests  was  completed  on  July  16, 
1999,  within  the  7-day  requirement  established  in  the  DoD  Management  Plan. 
The  final  report,  issued  August  9,  1999,  indicated  that  all  1,756  tests  covering 
the  three  core  business  processes  were  successful  and  that  no  Y2K-related 
failures  occurred.  The  original  CHCS  and  Defense  Blood  Standard  System  tests 
were  stopped  because  two  versions  of  Defense  Blood  Standard  System  software 
were  being  used.  However,  the  tests  were  restarted  and  successfiilly  completed 
upon  correction  of  the  testing  procedures.  Because  the  problem  was  associated 
with  the  testing  environment  and  not  the  AISs  that  were  tested,  AIS 
modifications  were  not  required. 

Patient  Administration  Results.  The  patient  administration  tests 
demonstrated  success  in  sending  and  receiving  date-related  data  in  a  Y2K 
environment.  The  quick  look  report  on  the  patient  administration  test  results 


6 


was  completed  on  July  7,  1999,  within  the  7-day  DoD  requirement.  The  final 
report,  dated  July  30,  1999,  stated  that  6,332  (93  percent)  of  6,840  planned  end- 
to-end  tests  covering  the  three  core  business  processes  were  successfully 
completed  by  June  30,  1999.  Of  the  remaining  508  tests,  504  tests  were  not 
performed  because  of  connectivity  problems  and  database  inconsistencies  not 
related  to  Y2K  problems.  The  event  team  reviewed  the  tests  that  were  not 
completed  and  decided  not  to  rerun  the  tests  because  each  of  the  mission-critical 
processes  involved  in  those  tests  had  already  been  involved  in  a  sufficient 
number  of  comprehensive  and  rigorous  end-to-end  tests.  The  remaining  four 
tests  failed  due  to  Y2K  problems,  specifically,  the  ability  of  CHCS  to  process  a 
date  received  from  DEERS  and  generate  nonavailability  statements.  The  four 
test  failures  were  fixed  and  retested  successfully,  and  the  software  correction 
has  been  deployed  to  update  software  copies  in  toe  field. 

Medical  Logistics  Results.  Testing  in  the  medical  logistics  area  was 
completed  September  22,  1999.  The  quick  look  report  on  the  medical  logistics 
test  results  was  completed  on  September  29,  1999,  within  the  7-day  DoD 
requirement.  The  report  showed  that  the  283  planned  medical  logistics  tests 
associated  with  the  mission-critical  process  of  ordering  pharmaceutical  and 
medical  surgical  supplies  had  been  successfully  completed.  One  system  failed 
during  the  test  of  February  29,  2000;  however,  a  software  modification  was 
developed  and  the  system  passed  the  retest.  The  modification  was  fielded  to 
update  copies  of  the  software.  Although  the  test  results  were  generally  positive, 
we  have  one  concern  regarding  the  possibility  of  contract  awards  to  new  prime 
vendors  that  would  not  have  had  the  opportunity  to  participate  in  end-to-end 
testing. 


Prime  Vendor  Contracts 


There  is  a  potential  risk  that  contracts  will  be  awarded  subsequent  to  end-to-end 
testing,  but  before  the  year  2000,  to  medical  materiel  prime  vendors  that  would 
not  have  had  the  opportunity  to  participate  in  the  medical  logistics  end-to-end 
testing.  Three  medical  materiel  contracts  are  scheduled  to  be  awarded  with 
effective  dates  in  November  1999.  Although  it  is  possible  that  the  contracts 
may  be  awarded  to  current  prime  vendors  that  have  participated  in  end-to-end 
testing,  it  is  also  possible  that  new  prime  vendors  will  be  awarded  the  contracts. 

The  Defense  Supply  Center,  Philadelphia,  manages  the  prime  vendor  program, 
including  the  transition  to  new  prime  vendors.  Personnel  from  the  Office  of  the 
ASD(HA)  met  with  supply  center  personnel  to  address  the  Y2K  risks  associated 
with  the  upcoming  contracts.  Although  alternatives  were  discussed,  such  as 
extending  the  current  contracts  until  Ae  year  2000,  it  was  agreed  to  wait  until 
the  contracts  were  awarded  to  determine  whether  a  problem  exists  and  then  take 
appropriate  action.  Although  standard  Federal  Acquisition  Regulation  clauses 
addressing  Y2K  compliance  do  not  apply  to  service  contracts,  the  contract 
solicitations  were  modified  to  include  a  Y2K  compliance  requirement.  To 
ensure  Y2K  compliance  in  the  medical  logistics  functional  area,  ASD(HA)  must 
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closely  monitor  the  awarding  of  prime  vendor  contracts  in  the  fall  of  1999  and 
take  appropriate  actions  to  mitigate  Y2K  risks  if  the  contracts  go  to  new 
prime  vendors. 


Recommendations  and  Management  Comments 


We  recommend  that  the  Assistant  Secretary  of  Defense  (Health  Affairs): 

1.  Obtain  the  year  2000  due  diligence  statements  from  contractors 
associated  with  the  patient  administration  area  end-to-end  testing. 

Management  Comments.  The  MHS  Chief  Information  Officer  concurred, 
stating  that  the  one  outstanding  due  diligence  statement  from  a  managed  care 
support  contractor  was  received  on  September  17,  1999.  Due  diligence 
statements  are  now  on  file  for  all  contractors  who  participated  in  the  patient 
administration  area  end-to-end  testing. 

2.  Monitor  any  transitions  to  new  medical  materiel  prime  vendors 
that  would  not  have  participated  in  end-to-end  tests  and  take  actions 
necessary  to  mitigate  risks  involved  with  such  transitions. 

Management  Comments.  The  MHS  Chief  Information  Officer  concurred, 
stating  that  the  Office  of  the  ASD(HA)  is  continuing  to  work  closely  with  the 
contracting  personnel  executing  the  prime  vendor  contracts  scheduled  to  be 
awarded  between  October  and  November  1999.  All  new  contracts  contain  the 
reference  that  vendors  must  have  Y2K  capable  systems.  However,  if  a  contract 
is  awarded  to  a  new  prime  vendor,  end-to-end  testing  will  be  completed  before 
the  operational  use  of  electronic  transactions  with  that  vendor. 
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Appendix  A.  Audit  Process 


This  is  one  in  a  series  of  reports  being  issued  by  the  Inspector  General,  DoD,  in 
accordance  with  an  informal  partnersWp  with  the  Chief  Information  Officer, 
DoD,  to  monitor  DoD  efforts  to  address  the  Y2K  computing  challenge.  For  a 
list  of  audit  projects  addressing  the  issue,  see  the  Y2K  web  pages  on  the  IGnet 
at  http://www.ignet.gov. 


Scope  and  Methodology 


Work  Performed.  We  reviewed  plans  and  reports  of  results  for  end-to-end 
tests  for  the  MHS  to  determine  if  the  ASD(HA)  had  performed  effective  tests 
and  whether  the  test  results  were  documented.  We  interviewed  personnel  from 
the  Office  of  the  ASD(HA)  responsible  for  developing  and  carrying  but  test 
plans  for  the  DoD  health  systems.  We  compared  the  DoD  health  system’s 
master  test  plan  (updated  in  April  1999)  and  the  patient  care,  patient 
administration,  and  medical  logistics  test  plans  (approved  May  through 
June  1999)  with  requirements  included  in  the  DoD  Management  Plan  issued  by 
the  Assistant  Secretary  of  Defense  (Command,  Control,  Communications,  and 
Intelligence)  in  December  1998.  We  reviewed  procedures  used  by  the  Office  of 
the  ASD(HA)  to  obtain  assurances  on  the  Y2K  compliance  of  contractor-owned 
AISs.  We  evaluated  test  scenarios,  observed  test  procedures,  and  reviewed 
quick  look  and  final  reports  issued  from  July  1999  through  September  1999  that 
contained  results  of  the  patient  care,  patient  administration,  and  medical 
logistics  tests. 

DoD-Wide  Corporate-Level  Goals.  In  response  to  the  Government 
Performance  and  Results  Act,  DoD  established  2  DoD-wide  corporate-level 
goals  and  7  subordinate  performance  goals.  This  report  pertains  to  achievement 
of  the  following  goal  and  subordinate  performance  goal: 

Goal  2:  Prepare  now  for  an  uncertain  future  by  pursuing  a  focused 
modernization  effort  that  maintains  U.S.  qualitative  superiority  in  key 
warfighting  capabilities.  Transform  the  force  by  exploring  the 
Revolution  in  Military  Affairs,  and  reengineer  the  Department  to  achieve 
a  21st  century  infrastructure.  Performance  Goal  2.2:  Transform  U.S. 
military  forces  for  the  future. 
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DoD  Functional  Area  Reform  Goals.  Most  major  DoD  functional  areas  have 
also  established  performance  improvement  reform  objectives  and  goals.  This 
report  pertains  to  achievement  of  the  following  objectives  and  goals  in  the 
Information  Technology  Management  Functional  Area. 

•  Objective:  Become  a  mission  partner.  Goal:  Serve  mission 
information  users  as  customers.  (ITIVI-1.2) 

•  Objective:  Provide  services  that  satisfy  customer  information  needs. 
Goal:  Modernize  and  integrate  Defense  information  infrastructure. 
(ITM-2.2)  Goal:  Upgrade  technology  base.  (ITM-2.3) 

High-Risk  Area.  In  its  identification  of  risk  areas,  the  General  Accounting 
Office  has  specifically  designated  risk  in  resolution  of  the  Y2K  problem  as  high. 
This  report  provides  coverage  of  that  problem  and  of  the  overall  Information 
Management  and  Technology  high-risk  area. 

Use  of  Technical  Assistance.  The  Technical  Assessment  Division,  Office  of 
the  Assistant  Inspector  General  for  Auditing,  assisted  us  in  evaluating  technical 
data  contained  in  the  patient  care,  patient  administration,  and  medical  logistics 
test  plans  and  in  the  quick  look  reports  addressing  patient  care  and  patient 
administration. 

Audit  Type,  Dates,  and  Standards.  We  performed  this  program  audit  from 
April  through  September  1999  in  accordance  with  auditing  standards  issued  by 
the  Comptroller  General  of  the  United  States,  as  implemented  by  the  Inspector 
General,  DoD.  We  used  computer-processed  data  for  this  audit,  but  we  did  not 
rely  on  the  information  to  arrive  at  our  audit  conclusions.  Therefore,  we  did 
not  perform  tests  to  determine  the  reliability  of  the  data. 

Contacts  During  the  Audit.  We  visited  or  contacted  individuals  and 
organizations  within  DoD.  Further  details  are  available  upon  request. 

Management  Control  Program.  We  did  not  review  the  management  control 
program  related  to  the  overall  audit  objective  because  DoD  recognized  the  Y2K 
issue  as  a  material  management  control  weakness  area  in  the  FY  1998  Annual 
Statement  of  Assurance. 
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Summary  of  Prior  Coverage 


The  General  Accounting  Office  and  the  Office  of  the  Inspector  General,  DoD, 
have  conducted  numerous  reviews  related  to  Y2K  issues.  General  Accounting 
Office  reports  can  be  accessed  over  the  Internet  at  http://www.gao.gov. 
Inspector  General,  DoD,  reports  can  be  accessed  over  the  Internet  at 
http://www.dodig.osd.mil.  The  Inspector  General,  DoD,  has  issued  three  audit 
reports  discussing  Y2K  issues  in  DoD  health  care. 


Inspector  General 

Inspector  General,  DoD,  Report  No.  99-255,  “Year  2000-Sensitive  Property 
Reutilized,  Transferred,  Donated,  or  Sold,”  September  15,  1999. 

Inspector  General,  DoD,  Report  No.  99-196,  “Year  2000  Computing  Issues 
Related  to  Health  Care  in  DoD  -  Phase  II,”  June  29,  1999. 

Inspector  General,  DoD,  Report  No.  99-055,  “Year  2000  Computing  Issues 
Related  to  Health  Care  in  DoD,”  December  15,  1998. 
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Appendix  B.  Report  Distribution 


Office  of  the  Secretary  of  Defense 

Under  Secretary  of  Defense  (Comptroller) 

Deputy  Chief  Financial  Officer 
Deputy  Comptroller  (Program/Budget) 

Under  Secretary  of  Defense  for  Personnel  and  Readiness 

Assistant  Secretary  of  Defense  (Command,  Control,  Communications,  and  Intelligence) 
Deputy  Chief  Information  Officer  and  Deputy  Assistant  Secretary  of  Defense  (Chief 
Information  Officer  Policy  and  Implementation) 

Principal  Director  for  Year  2000 
Assistant  Secretary  of  Defense  (Health  Affairs) 

Director,  Defense  Logistics  Studies  Information  Exchange 


Joint  Staff 

Director,  Joint  Staff 


Department  of  the  Army 

Assistant  Secretary  of  the  Army  (Financial  Management  and  Comptroller) 
Office  of  the  Surgeon  General  of  the  Army 
Auditor  General,  Department  of  the  Army 
Inspector  General,  Department  of  the  Army 

Department  of  the  Navy 

Assistant  Secretary  of  the  Navy  (Financial  Management  and  Comptroller) 

Office  of  the  Surgeon  General  of  the  Navy 

Auditor  General,  Department  of  the  Navy 

Inspector  General,  Department  of  the  Navy 

Inspector  General,  Marine  Corps 
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Department  of  the  Air  Force 

Assistant  Secretary  of  the  Air  Force  (Financial  Management  and  Comptroller) 
Office  of  the  Surgeon  General  of  the  Air  Force 
Auditor  General,  Department  of  the  Air  Force 
Inspector  General,  Department  of  the  Air  Force 

Unified  Commands 

Inspector  General,  U,S.  Joint  Forces  Command 
Inspector  General,  U.S.  European  Command 
Inspector  General,  U.S.  Pacific  Command 


Other  Defense  Organizations 

Director,  Defense  Contract  Audit  Agency 

Chief  Information  Officer,  Defense  Contract  Audit  Agency 
Director,  Defense  Information  Systems  Agency 

Inspector  General,  Defense  Information  Systems  Agency 
Chief  Information  Officer,  Defense  Information  Systems  Agency 
Director,  Defense  Logistics  Agency 
Director,  National  Security  Agency 

Inspector  General,  National  Security  Agency 
Inspector  General,  Defense  Intelligence  Agency 


Non-Defense  Federal  Organizations  and  Individuals 

Office  of  Management  and  Budget 

Office  of  Information  and  Regulatory  Affairs 
National  Security  Division  Special  Projects  Branch 
General  Accounting  Office 

National  Security  and  International  Affairs  Division 
Technical  Information  Center 

Director,  Defense  Information  and  Financial  Management  Systems,  Accounting  and 
Information  Management  Division 
Inspector  General,  General  Services  Administration 
Inspector  General,  Department  of  Health  and  Human  Services 
Inspector  General,  Department  of  Veterans  Affairs 


13 


Congressional  Committees  and  Subcommittees,  Chairman  and 
Ranking  Minority  Member 

Senate  Committee  on  Appropriations 

Senate  Subcommittee  on  Defense,  Committee  on  Appropriations 

Senate  Committee  on  Armed  Services 

Senate  Committee  on  Governmental  Affairs 

Senate  Special  Committee  on  the  Year  2000  Technology  Problem 

House  Committee  on  Appropriations 

House  Subcommittee  on  Defense,  Committee  on  Appropriations 
House  Committee  on  Armed  Services 
House  Committee  on  Government  Reform 

House  Subcommittee  on  Government  Management,  Information,  and  Technology, 
Committee  on  Government  Reform 

House  Subcommittee  on  National  Security,  Veterans  Affairs,  and  International 
Relations,  Committee  on  Government  Reform 
House  Subcommittee  on  Technology,  Committee  on  Science 
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Assistant  Secretary  of  Defense  (Health 
Affairs)  Comments 


OFFICE  OF  THE  ASSISTANT  SECRETARY  OF  DEFENSE 
WASHINGTON,  DC  20301-1200 

OCT  I  5  1999 

MEMORANDUM  FOR  DEPUTY  INSPECTOR  GENERAL,  DEPARTMENT  OF  DEFENSE 

SUBJECT:  Audit  Report  on  Year  2000  End-to-End  Tests  for  the  Military  Health  System 
(Project  No.  9LF-5046) 


HEALTH  AFFAIRS 


Reference  is  made  to  the  Director,  Readiness  and  Logistics  Support  Directorate 
memorandum,  dated  27  September  1999,  subject  as  above.  The  Department  of  Defense  Inspector 
General  (DoD  IG)  Draft  Audit  Report  documents  the  results  of  a  Health  Care  Year  2000  audit 
conducted  by  the  DoD  IG. 

As  with  previous  audits,  this  audit  was  conducted  in  an  atmosphere  of  partnership  and 
cooperation.  When  issues  surfaced  during  the  audit,  immediate  actions  were  taken  to  implement 
policy  and  procedures  to  address  those  issues.  The  attachment  contains  updated  information  on 
the  items  addressed  by  the  DoD  IG  recommendations  for  inclusion  in  the  final  report. 


Should  you  require  additional  information,  my  point  of  contact  is  Ms.  Clarissa  Reberkenny, 
Director,  Technology  Management,  Integration  and  Standards.  Ms.  Reberkenny  can  be  reached  at 
(703)  681-8823  or  by  e-mail  at  Clarissa.Rebcrkenny@tma.osd.mil. 


James  C.  Re; 

''Military  H^^JlTSystem 
Chief  Information  Officer 


Attachment: 
As  stated 
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Office  of  the  Assistant  Secretary  of  Defense  (Health  Affairs)  Responses 

to  the 

DoD  Inspector  General  Findings 
for 

Draft  Audit  Report  on  Year  2000  End-to-End  Test  for  the  Military  Health  System 

(Project  No.  9LF.5046) 


IG  Reconunendation  1 

Obtain  the  year  2000  due  diligence  statements  from  contractors  associated  with  the  patient 
administration  area  end-to-end  testing. 

OASDfHAl  Response  (concur): 

The  one  outstanding  letter  from  a  managed  care  support  contractor  was  received  on  17  September 
1999.  A  copy  was  provided  to  the  DoD  IG  audit  team.  There  is  now  on-file  all  due  diligence 
statements  for  all  contractors  who  participated  in  the  patient  administration  area  end-to-end 
testing. 

IG  Recommendation  2: 

Monitor  any  transitions  to  new  medical  materiel  prime  vendors  that  would  not  have  participated  in 
end-to-end  tests  and  take  actions  necessary  to  mitigate  risks  involved  with  such  transactions. 

Response  (concur): 

OASD(HA)  medical  logistics  program  office  is  continuing  to  work  closely  with  the  contracting 
personnel  executing  the  prime  vendor  contract  re-awards  scheduled  in  the  October-November 
1999  timeframe.  The  program  office  has  a  risk  mitigation  approach  to  ensure  that  there  is 
continuous  logistic  support  to  the  Military  Treatment  Facilities  involved.  All  new  contracts  have 
the  federally  mandated  Y2K  reference  that  the  vendors  must  have  Y2K  capable  systems.  Also, 
there  is  a  very  low  risk  if  a  contract  is  awarded  to  a  prime  vendor  that  was  included  in  the  end-to- 
end  testing.  However,  if  a  contract  is  awarded  to  a  new  prime  vendor,  Y2K  end-to-end  testing  will 
be  completed  with  the  new  prime  vendor  before  the  operational  use  of  electronic  transactions  with 
that  vendor. 


Attachment 
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Audit  Team  Members 


The  Readiness  and  logistics  Support  Directorate,  Office  of  the  Assistant 
Inspector  General  for  Auditing,  DoD,  prepared  this  report.  Personnel  from 
Office  of  the  Inspector  General,  DoD,  who  contributed  to  the  report  are 
listed  below. 

Shelton  R.  Young 
Michael  A.  Joseph 
Sanford  W.  Tomlin 
James  A,  O’Connell 
Robert  T.  Briggs 
G.  Paul  Johnson 
Eva  M.  Zahn 

Major  Michael  D.  Walker,  U.S.  Air  Force 


INTERNET  DOCUMENT  INFORMATION  FORM 


A .  Report  Title:  Year  2000  End-To-End  Tests  for  the  Military  Health 
System 

B.  DATE  Report  Downloaded  From  the  Internet:  02/08/99 


C.  Report’s  Point  of  Contact:  (Name,  Organization,  Address,  Office 
Symbol,  &  Ph  #):  OAIG-AUD  (ATTN:  AFTS  Audit  Suggestions) 

Inspector  General,  Department  of  Defense 
400  Army  Navy  Drive  (Room  801) 

Ariington,  VA  22202-2884 


D.  Currently  Applicable  Classification  Level:  Unclassified 

E.  Distribution  Statement  A:  Approved  for  Public  Release 

F.  The  foregoing  information  was  compiled  and  provided  by: 

DTIC-OCA,  Initials: _ VM _ Preparation  Date  02/08/99 


The  foregoing  information  should  exactly  correspond  to  the  Title,  Report  Number,  and  the  Date 
the  accompanying  report  document.  If  there  are  mismatches,  or  other  questions,  contact  the 
above  OCA  Representative  for  resolution. 


